Guides

Plain-English explanations behind every tool on this site: what each concept actually means, how it works, and how to fix the common problems.

Last updated: September 10, 2026

A staged roadmap tying every guide on this site together, from first visibility scan to DNSSEC.

What an SPF record does, the 10-lookup limit, and how to publish one without breaking mail.

How DKIM signs outgoing mail with a key pair, and how to generate and publish your own.

What DMARC does on top of SPF and DKIM, and the safe none → quarantine → reject rollout path.

Why DMARC enforcement is a hard prerequisite, and what actually separates a VMC from a CMC.

How to stop SMTP's TLS downgrade weakness and monitor delivery encryption failures.

Why an unused domain, or unused subdomains under an active one, can still be spoofed, and how to lock both down.

What TTL actually controls, and why different resolvers show different answers.

How to read CIDR notation and calculate network, broadcast, and usable host ranges.

What leaf, intermediate, and root certificates are, and what to actually check.

What each mail/web port is for, and the difference between implicit TLS and STARTTLS.

What HSTS, CSP, X-Frame-Options, and the rest actually defend against.

How a dangling CNAME leads to takeover, and how to prevent and fix it.

How to control which certificate authority is allowed to issue for your domain.

The techniques behind lookalike domains, and how to check whether one of yours has been taken.

How a JWT's header, payload, and signature fit together, and why decoding one isn't the same as verifying it.

What APR1-MD5, bcrypt, and SSHA are, and which one Apache and nginx each accept.

What cron's five fields mean, and the day-of-month/day-of-week rule that trips people up.